Any app developer tampering with this should get their app pulled out of the App Store, this is unacceptable.
It’s not more unacceptable for an exploit to exist than it is for the exploit to be used. One is a risk, the other is actively attempting to do harm.
This should be the case for all such interactions, including permissions, image library selection etc.
I realize APIs are hard to change but this is one of the cases where I think Apple should just fix it even if it bricks well-behaved apps until they can be patched (which could be never).